This vulnerability in Erlang OTP's ssh_sftp modules (lib/ssh/src/ssh_sftpd.erl) involves allocation of resources without proper limits or throttling, classified under CWE-770 and CWE-400. It affects OTP versions from 17.0 through 28.0.3 and related ssh versions from 3.0.1 to 5.3.3 and certain patch versions. The CVSS 4.0 score is 5.3 (medium severity), indicating network attack vector with low privileges required and no user interaction needed. The vulnerability could allow an attacker to cause excessive resource consumption or resource leaks, potentially impacting system stability or availability. There is no vendor advisory or patch information provided, and no known exploits have been reported.

The vulnerability allows excessive allocation of resources without limits or throttling in the ssh_sftp modules, which could lead to resource exhaustion or leaks. This may degrade system performance or availability but does not indicate direct code execution or data compromise. The medium CVSS score reflects a moderate impact primarily related to resource management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Erlang OTP vendor communications for updates. Until a fix is available, consider limiting exposure of affected ssh_sftp services and applying any relevant resource usage controls at the system or network level if feasible.